Hardware wallet maker Trezor has told customers who bought its devices from Southeast Asian reseller CryptoBilis to move their funds to a new wallet, after a customer reported finding a hidden implant inside a Trezor Safe 5.
The report has not been confirmed. Trezor has not yet received the device, but said it is treating the report as credible based on the customer’s description and a video interview.
“What we’ve seen looks sophisticated enough that we decided to warn customers now,” Trezor said.
What the customer reported
A customer in Indonesia reported the device through Trezor’s responsible disclosure programme on 28 October. It was a Trezor Safe 5 bought from CryptoBilis through online marketplace Tokopedia in August.
According to the report, an extra circuit board had been fitted between the main board and the screen, with a cellular module and an antenna. It reportedly reads what is shown on the screen, including the wallet’s recovery phrase, and sends it out over a mobile network whenever the device is plugged in.
Trezor has examined four other devices sourced from CryptoBilis, a Safe 7, two Safe 5s and a Safe 3, and found no sign of tampering.
No CryptoBilis buyer had reported a loss of funds to Trezor at the time of writing. Trezor removed CryptoBilis as a reseller on 9 October.
What Trezor is telling customers
Trezor says anyone who bought a Trezor wallet from CryptoBilis since March 2026 should move their funds to a new wallet with a new recovery phrase as soon as possible.
It says the old recovery phrase should not be reused on any device, and buyers who have not set up their device yet should not use it.
Affected customers can keep the device and contact Trezor Support for a replacement.
The Ledger connection
The report follows a similar case at Ledger. Ledger’s security team found an implant in Ledger devices sold through CryptoBilis that reads the recovery phrase from the screen during setup and sends it out over a mobile connection. Ledger has said all its confirmed losses involve CryptoBilis devices.
Trezor said the new report “appears to operate similarly,” but would not draw further comparisons while investigations continue. It said it does not know who is behind either implant.
What happens next
The key step is Trezor examining the device itself, which will confirm whether the implant is real and how it works.
